2023-04-14 18:12:31 +00:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
|
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
|
2023-03-29 19:06:09 +00:00
|
|
|
package pki
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
2023-04-03 20:08:25 +00:00
|
|
|
"net/http"
|
2023-03-29 19:06:09 +00:00
|
|
|
"strings"
|
|
|
|
|
2023-04-12 13:05:42 +00:00
|
|
|
"github.com/hashicorp/go-secure-stdlib/strutil"
|
|
|
|
|
2023-03-29 19:06:09 +00:00
|
|
|
"github.com/hashicorp/vault/sdk/framework"
|
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
|
|
|
)
|
|
|
|
|
2023-04-12 15:29:54 +00:00
|
|
|
func uuidNameRegex(name string) string {
|
|
|
|
return fmt.Sprintf("(?P<%s>[[:alnum:]]{8}-[[:alnum:]]{4}-[[:alnum:]]{4}-[[:alnum:]]{4}-[[:alnum:]]{12}?)", name)
|
|
|
|
}
|
|
|
|
|
2023-04-14 18:48:33 +00:00
|
|
|
func pathAcmeNewAccount(b *backend) []*framework.Path {
|
|
|
|
return buildAcmeFrameworkPaths(b, patternAcmeNewAccount, "/new-account")
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
|
2023-04-14 18:48:33 +00:00
|
|
|
func pathAcmeUpdateAccount(b *backend) []*framework.Path {
|
|
|
|
return buildAcmeFrameworkPaths(b, patternAcmeNewAccount, "/account/"+uuidNameRegex("kid"))
|
2023-04-12 13:05:42 +00:00
|
|
|
}
|
|
|
|
|
2023-03-29 19:06:09 +00:00
|
|
|
func addFieldsForACMEPath(fields map[string]*framework.FieldSchema, pattern string) map[string]*framework.FieldSchema {
|
|
|
|
if strings.Contains(pattern, framework.GenericNameRegex("role")) {
|
|
|
|
fields["role"] = &framework.FieldSchema{
|
|
|
|
Type: framework.TypeString,
|
|
|
|
Description: `The desired role for the acme request`,
|
|
|
|
Required: true,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if strings.Contains(pattern, framework.GenericNameRegex(issuerRefParam)) {
|
|
|
|
fields[issuerRefParam] = &framework.FieldSchema{
|
|
|
|
Type: framework.TypeString,
|
|
|
|
Description: `Reference to an existing issuer name or issuer id`,
|
|
|
|
Required: true,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return fields
|
|
|
|
}
|
|
|
|
|
|
|
|
func addFieldsForACMERequest(fields map[string]*framework.FieldSchema) map[string]*framework.FieldSchema {
|
|
|
|
fields["protected"] = &framework.FieldSchema{
|
|
|
|
Type: framework.TypeString,
|
|
|
|
Description: "ACME request 'protected' value",
|
2023-03-29 21:08:31 +00:00
|
|
|
Required: false,
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
fields["payload"] = &framework.FieldSchema{
|
|
|
|
Type: framework.TypeString,
|
|
|
|
Description: "ACME request 'payload' value",
|
2023-03-29 21:08:31 +00:00
|
|
|
Required: false,
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
fields["signature"] = &framework.FieldSchema{
|
|
|
|
Type: framework.TypeString,
|
|
|
|
Description: "ACME request 'signature' value",
|
2023-03-29 21:08:31 +00:00
|
|
|
Required: false,
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return fields
|
|
|
|
}
|
|
|
|
|
2023-04-12 13:05:42 +00:00
|
|
|
func addFieldsForACMEKidRequest(fields map[string]*framework.FieldSchema, pattern string) map[string]*framework.FieldSchema {
|
|
|
|
if strings.Contains(pattern, framework.GenericNameRegex("kid")) {
|
|
|
|
fields["kid"] = &framework.FieldSchema{
|
|
|
|
Type: framework.TypeString,
|
|
|
|
Description: `The key identifier provided by the CA`,
|
|
|
|
Required: true,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return fields
|
|
|
|
}
|
|
|
|
|
2023-03-29 19:06:09 +00:00
|
|
|
func patternAcmeNewAccount(b *backend, pattern string) *framework.Path {
|
|
|
|
fields := map[string]*framework.FieldSchema{}
|
|
|
|
addFieldsForACMEPath(fields, pattern)
|
|
|
|
addFieldsForACMERequest(fields)
|
2023-04-12 13:05:42 +00:00
|
|
|
addFieldsForACMEKidRequest(fields, pattern)
|
2023-03-29 19:06:09 +00:00
|
|
|
|
|
|
|
return &framework.Path{
|
|
|
|
Pattern: pattern,
|
|
|
|
Fields: fields,
|
|
|
|
Operations: map[logical.Operation]framework.OperationHandler{
|
|
|
|
logical.UpdateOperation: &framework.PathOperation{
|
|
|
|
Callback: b.acmeParsedWrapper(b.acmeNewAccountHandler),
|
|
|
|
ForwardPerformanceSecondary: false,
|
|
|
|
ForwardPerformanceStandby: true,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
|
|
|
|
HelpSynopsis: pathOcspHelpSyn,
|
|
|
|
HelpDescription: pathOcspHelpDesc,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-04-03 20:08:25 +00:00
|
|
|
func (b *backend) acmeNewAccountHandler(acmeCtx *acmeContext, r *logical.Request, fields *framework.FieldData, userCtx *jwsCtx, data map[string]interface{}) (*logical.Response, error) {
|
2023-03-29 19:06:09 +00:00
|
|
|
// Parameters
|
|
|
|
var ok bool
|
|
|
|
var onlyReturnExisting bool
|
2023-04-03 20:08:25 +00:00
|
|
|
var contacts []string
|
2023-03-29 19:06:09 +00:00
|
|
|
var termsOfServiceAgreed bool
|
2023-04-12 13:05:42 +00:00
|
|
|
var status string
|
2023-03-29 19:06:09 +00:00
|
|
|
|
|
|
|
rawContact, present := data["contact"]
|
|
|
|
if present {
|
2023-04-03 20:08:25 +00:00
|
|
|
listContact, ok := rawContact.([]interface{})
|
2023-03-29 19:06:09 +00:00
|
|
|
if !ok {
|
2023-04-03 20:08:25 +00:00
|
|
|
return nil, fmt.Errorf("invalid type (%T) for field 'contact': %w", rawContact, ErrMalformed)
|
|
|
|
}
|
|
|
|
|
|
|
|
for index, singleContact := range listContact {
|
|
|
|
contact, ok := singleContact.(string)
|
|
|
|
if !ok {
|
|
|
|
return nil, fmt.Errorf("invalid type (%T) for field 'contact' item %d: %w", singleContact, index, ErrMalformed)
|
|
|
|
}
|
|
|
|
|
|
|
|
contacts = append(contacts, contact)
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
rawTermsOfServiceAgreed, present := data["termsOfServiceAgreed"]
|
|
|
|
if present {
|
|
|
|
termsOfServiceAgreed, ok = rawTermsOfServiceAgreed.(bool)
|
|
|
|
if !ok {
|
2023-04-03 20:08:25 +00:00
|
|
|
return nil, fmt.Errorf("invalid type (%T) for field 'termsOfServiceAgreed': %w", rawTermsOfServiceAgreed, ErrMalformed)
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
rawOnlyReturnExisting, present := data["onlyReturnExisting"]
|
|
|
|
if present {
|
|
|
|
onlyReturnExisting, ok = rawOnlyReturnExisting.(bool)
|
|
|
|
if !ok {
|
2023-04-03 20:08:25 +00:00
|
|
|
return nil, fmt.Errorf("invalid type (%T) for field 'onlyReturnExisting': %w", rawOnlyReturnExisting, ErrMalformed)
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-04-12 13:05:42 +00:00
|
|
|
// Per RFC 8555 7.3.6 Account deactivation, we will handle it within our update API.
|
|
|
|
rawStatus, present := data["status"]
|
|
|
|
if present {
|
|
|
|
status, ok = rawStatus.(string)
|
|
|
|
if !ok {
|
|
|
|
return nil, fmt.Errorf("invalid type (%T) for field 'onlyReturnExisting': %w", rawOnlyReturnExisting, ErrMalformed)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-03-29 19:06:09 +00:00
|
|
|
// We ignore the EAB parameter as it is currently not supported.
|
|
|
|
|
|
|
|
// We have two paths here: search or create.
|
|
|
|
if onlyReturnExisting {
|
2023-04-12 15:29:54 +00:00
|
|
|
return b.acmeNewAccountSearchHandler(acmeCtx, userCtx)
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
|
2023-04-12 13:05:42 +00:00
|
|
|
// Pass through the /new-account API calls to this specific handler as its requirements are different
|
|
|
|
// from the account update handler.
|
|
|
|
if strings.HasSuffix(r.Path, "/new-account") {
|
2023-04-12 15:29:54 +00:00
|
|
|
return b.acmeNewAccountCreateHandler(acmeCtx, userCtx, contacts, termsOfServiceAgreed)
|
2023-04-12 13:05:42 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return b.acmeNewAccountUpdateHandler(acmeCtx, userCtx, contacts, status)
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
|
2023-04-12 15:29:54 +00:00
|
|
|
func formatAccountResponse(acmeCtx *acmeContext, acct *acmeAccount) *logical.Response {
|
|
|
|
location := acmeCtx.baseUrl.String() + "account/" + acct.KeyId
|
|
|
|
|
2023-03-29 19:06:09 +00:00
|
|
|
resp := &logical.Response{
|
|
|
|
Data: map[string]interface{}{
|
2023-04-03 20:08:25 +00:00
|
|
|
"status": acct.Status,
|
2023-03-29 19:06:09 +00:00
|
|
|
"orders": location + "/orders",
|
|
|
|
},
|
2023-04-03 20:08:25 +00:00
|
|
|
Headers: map[string][]string{
|
|
|
|
"Location": {location},
|
|
|
|
},
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
|
2023-04-03 20:08:25 +00:00
|
|
|
if len(acct.Contact) > 0 {
|
|
|
|
resp.Data["contact"] = acct.Contact
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return resp
|
|
|
|
}
|
|
|
|
|
2023-04-12 15:29:54 +00:00
|
|
|
func (b *backend) acmeNewAccountSearchHandler(acmeCtx *acmeContext, userCtx *jwsCtx) (*logical.Response, error) {
|
|
|
|
thumbprint, err := userCtx.GetKeyThumbprint()
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("failed generating thumbprint for key: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
account, err := b.acmeState.LoadAccountByKey(acmeCtx, thumbprint)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("failed to load account by thumbprint: %w", err)
|
|
|
|
}
|
2023-03-29 19:06:09 +00:00
|
|
|
|
2023-04-12 15:29:54 +00:00
|
|
|
if account != nil {
|
|
|
|
return formatAccountResponse(acmeCtx, account), nil
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Per RFC 8555 Section 7.3.1. Finding an Account URL Given a Key:
|
|
|
|
//
|
|
|
|
// > If a client sends such a request and an account does not exist,
|
|
|
|
// > then the server MUST return an error response with status code
|
|
|
|
// > 400 (Bad Request) and type "urn:ietf:params:acme:error:accountDoesNotExist".
|
2023-03-29 21:08:31 +00:00
|
|
|
return nil, fmt.Errorf("An account with this key does not exist: %w", ErrAccountDoesNotExist)
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
|
2023-04-12 15:29:54 +00:00
|
|
|
func (b *backend) acmeNewAccountCreateHandler(acmeCtx *acmeContext, userCtx *jwsCtx, contact []string, termsOfServiceAgreed bool) (*logical.Response, error) {
|
2023-03-29 19:06:09 +00:00
|
|
|
if userCtx.Existing {
|
2023-03-29 21:08:31 +00:00
|
|
|
return nil, fmt.Errorf("cannot submit to newAccount with 'kid': %w", ErrMalformed)
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// If the account already exists, return the existing one.
|
2023-04-12 15:29:54 +00:00
|
|
|
thumbprint, err := userCtx.GetKeyThumbprint()
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("failed generating thumbprint for key: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
accountByKey, err := b.acmeState.LoadAccountByKey(acmeCtx, thumbprint)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("failed to load account by thumbprint: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
if accountByKey != nil {
|
|
|
|
return formatAccountResponse(acmeCtx, accountByKey), nil
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
|
|
|
|
2023-04-12 13:05:42 +00:00
|
|
|
// TODO: Limit this only when ToS are required or set by the operator, since we don't have a
|
|
|
|
// ToS URL in the directory at the moment, we can not enforce this.
|
|
|
|
//if !termsOfServiceAgreed {
|
|
|
|
// return nil, fmt.Errorf("terms of service not agreed to: %w", ErrUserActionRequired)
|
|
|
|
//}
|
2023-03-29 19:06:09 +00:00
|
|
|
|
2023-04-12 15:29:54 +00:00
|
|
|
accountByKid, err := b.acmeState.CreateAccount(acmeCtx, userCtx, contact, termsOfServiceAgreed)
|
2023-03-29 19:06:09 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("failed to create account: %w", err)
|
|
|
|
}
|
|
|
|
|
2023-04-12 15:29:54 +00:00
|
|
|
resp := formatAccountResponse(acmeCtx, accountByKid)
|
2023-04-03 20:08:25 +00:00
|
|
|
|
|
|
|
// Per RFC 8555 Section 7.3. Account Management:
|
|
|
|
//
|
|
|
|
// > The server returns this account object in a 201 (Created) response,
|
|
|
|
// > with the account URL in a Location header field.
|
|
|
|
resp.Data[logical.HTTPStatusCode] = http.StatusCreated
|
|
|
|
return resp, nil
|
2023-03-29 19:06:09 +00:00
|
|
|
}
|
2023-04-12 13:05:42 +00:00
|
|
|
|
|
|
|
func (b *backend) acmeNewAccountUpdateHandler(acmeCtx *acmeContext, userCtx *jwsCtx, contact []string, status string) (*logical.Response, error) {
|
|
|
|
if !userCtx.Existing {
|
|
|
|
return nil, fmt.Errorf("cannot submit to account updates without a 'kid': %w", ErrMalformed)
|
|
|
|
}
|
|
|
|
|
|
|
|
account, err := b.acmeState.LoadAccount(acmeCtx, userCtx.Kid)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("error loading account: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Per RFC 8555 7.3.6 Account deactivation, if we were previously deactivated, we should return
|
|
|
|
// unauthorized. There is no way to reactivate any accounts per ACME RFC.
|
|
|
|
if account.Status != StatusValid {
|
|
|
|
// Treating "revoked" and "deactivated" as the same here.
|
|
|
|
return nil, ErrUnauthorized
|
|
|
|
}
|
|
|
|
|
|
|
|
shouldUpdate := false
|
|
|
|
// Check to see if we should update, we don't really care about ordering
|
|
|
|
if !strutil.EquivalentSlices(account.Contact, contact) {
|
|
|
|
shouldUpdate = true
|
|
|
|
account.Contact = contact
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check to process account de-activation status was requested.
|
|
|
|
// 7.3.6. Account Deactivation
|
|
|
|
if string(StatusDeactivated) == status {
|
|
|
|
shouldUpdate = true
|
|
|
|
// TODO: This should cancel any ongoing operations (do not revoke certs),
|
|
|
|
// perhaps we should delete this account here?
|
|
|
|
account.Status = StatusDeactivated
|
|
|
|
}
|
|
|
|
|
|
|
|
if shouldUpdate {
|
|
|
|
err = b.acmeState.UpdateAccount(acmeCtx, account)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("failed to update account: %w", err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-04-12 15:29:54 +00:00
|
|
|
resp := formatAccountResponse(acmeCtx, account)
|
2023-04-12 13:05:42 +00:00
|
|
|
return resp, nil
|
|
|
|
}
|